Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 2, 2021, 8:49 a.m.	April 2, 2021, 8:51 a.m.

Size	290.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3042197ad6105dda04eebe2ec5b55747`
SHA256	`59ba969dc69d82f3980cb18aa1184f56654ed4fe6a40c4234c6bb7221b0bb2bb`
CRC32	`F6CF99F7`
ssdeep	`6144:k9cXlo+UwAEsOq8TmSvJ8ZAKJ7sPnvtxEO7ZURjvqkxQ:lJUwAEsYf8ZAKJ7itxEO7ZURjK`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero

reg.exe "C:\Users\test22\AppData\Local\Temp\reg.exe"
1016
- reg.exe "C:\Users\test22\AppData\Local\Temp\3582-490\reg.exe"
  2384

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 2, 2021, 8:42 a.m.			0	0
IsDebuggerPresent April 2, 2021, 8:42 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 2, 2021, 8:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000806980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 8:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000806910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 8:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000806910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 2, 2021, 8:49 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002320000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24064 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002440400 process_handle: 0xffffffffffffffff		-1073741746
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002440188 process_handle: 0xffffffffffffffff		-1073741746
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024401b0 process_handle: 0xffffffffffffffff		-1073741746
NtProtectVirtualMemory April 2, 2021, 8:42 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024401d8 process_handle: 0xffffffffffffffff		-1073741746

Creates executable files on the filesystem (50 out of 120 events)

file	C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file	C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file	C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file	C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file	C:\Python27\Scripts\easy_install.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file	C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file	C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file	C:\Program Files (x86)\EditPlus\editplus.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file	C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file	C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe
file	C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe
file	C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
file	C:\util\TCPView\Tcpvcon.exe
file	C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer\chrmstp.exe
file	C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file	C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file	C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe
file	C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file	C:\Program Files (x86)\Hnc\HncUtils\KeyLayout\KeyLayout.exe
file	C:\util\dotnet4.5.exe
file	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\GrooveMigrator.exe
file	C:\Program Files (x86)\Hnc\PDF80\x64\HNCE2PPRCONV80.exe
file	C:\Program Files (x86)\Hnc\Common80\him\HJIMESV.EXE
file	C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\OINFOP12.EXE
file	C:\Program Files (x86)\Hnc\Common80\OdfConverter.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\IME12\SHARED\IMEPADSV.EXE

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\3582-490\reg.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Users\test22\AppData\Local\Temp\3582-490\reg.exe"
cmdline	C:\Users\test22\AppData\Local\Temp\3582-490\reg.exe

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

reg_value

C:\Windows\svchost.com "%1" %*

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.NeshtaB.PE
Elastic	malicious (high confidence)
DrWeb	Win32.HLLP.Neshta
MicroWorld-eScan	Win32.Neshta.A
FireEye	Generic.mg.3042197ad6105dda
CAT-QuickHeal	W32.Neshta.C8
McAfee	W32/HLLP.41472.e
Malwarebytes	Virus.Neshta
Zillya	Virus.Neshta.Win32.1
K7AntiVirus	Virus ( 00556e571 )
K7GW	Virus ( 00556e571 )
Cybereason	malicious.ad6105
Arcabit	Win32.Neshta.A
BitDefenderTheta	AI:FileInfector.D5C3B0640E
Cyren	W32/Neshta.OBIX-2981
Symantec	W32.Neshuta
ESET-NOD32	Win32/Neshta.A
APEX	Malicious
ClamAV	Win.Trojan.Neshuta-1
BitDefender	Win32.Neshta.A
NANO-Antivirus	Trojan.Win32.Winlock.fmobyw
ViRobot	Win32.Neshta.Gen.A
Tencent	Virus.Win32.Neshta.a
Ad-Aware	Win32.Neshta.A
Sophos	ML/PE-A + W32/Neshta-D
Comodo	Win32.Neshta.A@3ypg
Baidu	Win32.Virus.Neshta.a
VIPRE	Virus.Win32.Neshta.a (v)
McAfee-GW-Edition	BehavesLike.Win32.HLLP.dc
Emsisoft	Win32.Neshta.A (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Virus.Neshta.a
Avira	W32/Neshta.A
MAX	malware (ai score=84)
Gridinsoft	Virus.Win32.Neshta.ka!s8
Microsoft	Virus:Win32/Neshta.A
GData	Win32.Virus.Neshta.D
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/Neshta
Acronis	suspicious
VBA32	Virus.Win32.Neshta.a
ALYac	Win32.Neshta.A
TACHYON	Virus/W32.Neshta
Zoner	Virus.Win32.19514
TrendMicro-HouseCall	PE_NESHTA.A
Rising	HackTool.CoinMiner!1.CB20 (RDMK:cmRtazq8Hm8t6E6NnjsvbmBqwIZe)
Yandex	Trojan.GenAsa!Mo0tdcmmg3o
Ikarus	Virus.Win32.Neshta
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Generic.AC.171!tr

reg.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All